Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len
To:     David Hildenbrand <david@redhat.com>, Li Qiang <liq3ea@gmail.com>,
        alex.williamson@redhat.com
Cc:     kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        liqiang02@corp.netease.com
References: <1535374041-3551-1-git-send-email-liq3ea@gmail.com>
 <a6eb3c83-13c2-587a-557c-f1f072a0deff@redhat.com>
From:   Auger Eric <eric.auger@redhat.com>
Message-ID: <ab8ffb59-03fb-c794-4cf7-76c72473eaeb@redhat.com>
Date:   Mon, 3 Sep 2018 19:00:17 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <a6eb3c83-13c2-587a-557c-f1f072a0deff@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Li, David,

On 08/30/2018 04:15 PM, David Hildenbrand wrote:
> On 27.08.2018 14:47, Li Qiang wrote:
>> Free the vdev->msi_perm in error path.
>>
>> Signed-off-by: Li Qiang <liq3ea@gmail.com>
>> ---
>>  drivers/vfio/pci/vfio_pci_config.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
>> index 115a36f6f403..62023b4a373b 100644
>> --- a/drivers/vfio/pci/vfio_pci_config.c
>> +++ b/drivers/vfio/pci/vfio_pci_config.c
>> @@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
>>  		return -ENOMEM;
>>  
>>  	ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
>> -	if (ret)
>> +	if (ret) {
>> +		kfree(vdev->msi_perm);
>>  		return ret;
>> +	}
>>  
>>  	return len;
>>  }
>>
> 
> Doesn't vfio_config_free() take care of that in all cases?

Looks OK to me.
Reviewed-by: Eric Auger <eric.auger@redhat.com>

Looks vfio_config_free is called on vfio_pci_release whereas
vfio_msi_cap_len can fail in vfio_pci_open path.

Thanks

Eric
>